Back up and recover Gateway

Back up configuration, signed license, TLS certificates and private keys, the state-encryption key, and the persistent storage.directory; protect each as secret material. In HA, back up each node’s local state and secrets. Raft snapshots are encrypted and live under storage.directory/raft/snapshots. The storage.snapshot_directory setting is retained for configuration compatibility but is not consumed by V1 runtime code; do not rely on it as a snapshot location. Do not expect configuration, licenses, keys, logs, reports, or TLS material to replicate.

The durable store contains live leases and idempotency bindings. Losing it is recoverable operationally but discards lease state: product clients retain their last valid lease only until expiry, then must acquire again. Do not restore state without its exact encryption key, and never merge old state into a running pair.

For standalone loss, build a replacement with the same configured IDs, restore a consistent backup where available, then verify readiness. For an HA active loss, let the peer enter degraded-active after the configured timeout, restore the failed node with its original configuration/secrets, then verify /v1/ha convergence. For standby loss, restore that node and verify peer connectivity. A total rebuild requires a replacement license if gateway_id or a replica ID changes; the rebuilt service starts with no live leases if state is not restored. V1 has no documented backup/restore CLI, so perform file-level recovery only while services are stopped and use your tested platform backup procedure.